On Tue, 15 Jul 2014 15:58:32 +0400 Konstantin Khlebnikov <k.khlebnikov@xxxxxxxxxxx> wrote:
> From: Konstantin Khlebnikov <koct9i@xxxxxxxxx>
>
> Faulting around non-linear page-fault has no sense and
> breaks logic in do_fault_around because pgoff is shifted.
>
Please be a lot more careful with the changelogs? This one failed to
describe the effects of the bug, failed to adequately describe the bug
itself, failed to describe the offending commits and failed to identify
which kernel versions need the patch.
Sigh. I went back and assembled the necessary information, below.
Please check it.
From: Konstantin Khlebnikov <koct9i@xxxxxxxxx>
Subject: mm: do not call do_fault_around for non-linear fault
Ingo Korb reported that "repeated mapping of the same file on tmpfs using
remap_file_pages sometimes triggers a BUG at mm/filemap.c:202 when the
process exits". He bisected the bug to d7c1755179b82d ("mm: implement
->map_pages for shmem/tmpfs"), although the bug was actually added by
8c6e50b0290c4 ("mm: introduce vm_ops->map_pages()").
Problem is caused by calling do_fault_around for _non-linear_ faiult. In
this case pgoff is shifted and might become negative during calculation.
Faulting around non-linear page-fault has no sense and breaks logic in
do_fault_around because pgoff is shifted.
Signed-off-by: Konstantin Khlebnikov <koct9i@xxxxxxxxx>
Reported-by: "Ingo Korb" <ingo.korb@xxxxxxxxxxxxxx>
Tested-by: "Ingo Korb" <ingo.korb@xxxxxxxxxxxxxx>
Cc: Hugh Dickins <hughd@xxxxxxxxxx>
Cc: Sasha Levin <sasha.levin@xxxxxxxxxx>
Cc: Dave Jones <davej@xxxxxxxxxx>
Cc: Ning Qu <quning@xxxxxxxxxx>
Cc: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx> [3.15.x]
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/memory.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff -puN mm/memory.c~mm-do-not-call-do_fault_around-for-non-linear-fault mm/memory.c
--- a/mm/memory.c~mm-do-not-call-do_fault_around-for-non-linear-fault
+++ a/mm/memory.c
@@ -2882,7 +2882,8 @@ static int do_read_fault(struct mm_struc
* if page by the offset is not ready to be mapped (cold cache or
* something).
*/
- if (vma->vm_ops->map_pages && fault_around_pages() > 1) {
+ if (vma->vm_ops->map_pages && !(flags & FAULT_FLAG_NONLINEAR) &&
+ fault_around_pages() > 1) {
pte = pte_offset_map_lock(mm, pmd, address, &ptl);
do_fault_around(vma, address, pte, pgoff, flags);
if (!pte_same(*pte, orig_pte))
_
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>